Late last month, a Southern California man was sentenced to three years in jail for hijacking local ATMs to rob bank customers of more than $200,000. His method, called "skimming" is not new, and the authorities know how to defeat it.
But security experts say that this low-tech form of bank fraud will continue in the U.S. because banks and merchants are balking at replacing our outdated magnetic-stripe card system.
"It's all going to migrate here because the account information [on] magnetic strip cards is very easily copied," said Frank Rudewicz, head of the Forensic and Investigative division for accounting and consulting firm Marcum LLP.
Skimmers steal or "skim" cardholders' account numbers by attaching portable electronic readers to ATM machines to copy data from the card's magnetic strip.
The thief still needs the cardholder's PIN, Rudewicz explains, but can easily obtain it with a hidden camera installed on the ATM, or by means of a plastic covering laid onto the ATM's keypad that logs keystrokes.
European banks no longer use magnetic strips, a technology that is a half-century old. Instead, microchips embedded in the cards communicate with the ATM to identify customers. "They're much farther along than we are," says Rudewicz.
The microchip technology is called E.M.V., for EuroPay, MasterCard , and Visa , the companies who have driven the switch to microchip-enabled credit and debit cards in Europe and the U.K.
Each time an E.M.V. card is swiped, it produces a "unique transaction identifier" — a security code for that particular transaction. "If someone steals an account number, they can’t do anything with it because they need the security code the chip produces," said Scott Talbott of the Financial Services Rountable, an organization representing the top 100 U.S. banks.
Though U.S. banks are adept at catching fraud after the fact by tracking card usage, the rising cost of ATM theft is driving American banks toward updating to microchips. "The average total amount skimmed per ATM is now about $50,000," said Julie McNelley, research director and fraud analyst at Aite Group. McNelley described skimming as having "turned from two-penny crooks to an organized crime."
Some banks are launching pilot programs using E.M.V.-updated systems, and WellsFargo , has issued E.M.V.-enabled cards (also bearing magnetic strips) to 15,000 of their customers so they can use their cards overseas.
Researchers, trade groups and banks agree, however, that implementing E.M.V. on these shores will be difficult. "It would take the coordination of banks and merchants. We have to change the hardware on all of the card readers. It’s costly," said Talbott.
But Talbott and other security experts say that sticking with magnetic strips, besides carrying its own costs, is embarrassing because its preventable.
Take it from a victim.
"Ironically, I was at a white-collar crime conference in Miami when it happened," says Frank Rudewicz. "By the time I flew back to the northeast, my bank informed me that thieves skimmed my card, made another card, and had made purchases in Georgia. I've never been to Georgia."
Given Rudewicz's position as a head of a forensics and investigation team, he said, "It just points out that anyone, anywhere can be a victim."